Skip to content
Fencer Vulns
high 7.8

CVE-2020-8907 json

Priviged Escalation in Google Cloud Platform's Guest-OSLogin

published 2020-06-22 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-29746

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits
0
none known

Summary

A vulnerability in Google Cloud Platform's guest-oslogin versions between 20190304 and 20200507 allows a user that is only granted the role "roles/compute.osLogin" to escalate privileges to root. Using their membership to the "docker" group, an attacker with this role is able to run docker and mount the host OS. Within docker, it is possible to modify the host OS filesystem and modify /etc/groups to gain administrative privileges. All images created after 2020-May-07 (20200507) are fixed, and if you cannot update, we recommend you edit /etc/group/security.conf and remove the "docker" user from the OS Login entry.

Patch / fix

  • Google LLC guest-oslogin 20200507
  • gce-compute-image-packages Ubuntu 16.04 LTS 20190801-0ubuntu1~16.04.1
  • gce-compute-image-packages Ubuntu 18.04 LTS 20190801-0ubuntu1~18.04.1
  • gce-compute-image-packages Ubuntu 20.04 LTS 20190801-0ubuntu4.1

ubuntu advisories UBUNTU-CVE-2020-8907

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • google-compute-engine SLE Module for Public Cloud 12 20190801-54.1
  • google-compute-engine SLE Module for Public Cloud 15 SP2, SLE Module for Public Cloud 15 SP1 20190801-4.38.1

suse advisories SUSE-SU-2020:2200-1SUSE-SU-2020:1934-1

  • google-compute-engine openSUSE Leap 15.2 20190801-lp152.5.4.1
  • google-compute-engine openSUSE Leap 15.1 20190801-lp151.2.25.1

opensuse advisories openSUSE-SU-2020:1014-1openSUSE-SU-2020:0996-1

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • gitlab.com https://gitlab.com/gitlab-com/gl-security/gl-redteam/red-team-tech-notes/-/tree/master/oslogin-privesc-june-2020 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 9.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Google LLC guest-oslogin

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.